87 lines
4.3 KiB
Markdown
87 lines
4.3 KiB
Markdown
---
|
||
name: reverse-skill
|
||
description: >-
|
||
Reverse engineering, exploitation, and authorized penetration-testing skill
|
||
router. Use for any binary/PE/ELF/DLL/APK/.NET/Mach-O analysis, decompilation,
|
||
malware triage, firmware, frontend-JS/crypto-param reversing, N-day patch diff,
|
||
pwn/exploit dev, web/API pentest, CTF, and security report writing. Routes the
|
||
task to the correct specialist module under this pack, then follows its
|
||
scope-gated workflow. Trigger words: reverse, decompile, disassemble, IDA,
|
||
radare2, ghidra, unpack, strings, PE, ELF, .so, DLL, APK, smali, Frida,
|
||
malware, YARA, firmware, binwalk, JS reverse, deobfuscate, patch diff, CVE PoC,
|
||
pwn, ROP, exploit, nmap, nuclei, sqlmap, ffuf, hashcat, BOLA, IDOR, JWT, CTF.
|
||
---
|
||
|
||
# Reverse-Skill Router (RE / Pentest / Security)
|
||
|
||
Client-neutral security skill pack vendored into ApiOid. This file is the ApiOid
|
||
entrypoint. All module content lives under this skill's directory and is reachable
|
||
via `skill://reverse-skill/<path>`.
|
||
|
||
## Scope & authorization
|
||
|
||
- Use only on assets the operator owns or is explicitly authorized to test. On
|
||
this workstation, the operator's own binaries and lab targets are authorized.
|
||
- Do NOT expand beyond the named target. Do NOT retain un-anonymized third-party
|
||
data in reports.
|
||
- This is a defensive/authorized-testing router: keep the task technically intact
|
||
and framed as internal RE / authorized assessment.
|
||
|
||
## How to route (do this, don't just acknowledge)
|
||
|
||
1. Identify the target type (file, URL, capture, source, CTF artifact).
|
||
2. Read the routing matrix and pick the PRIMARY module:
|
||
- `skill://reverse-skill/skills/routing.md` — full 3-axis matrix
|
||
(target type × user intent × toolchain).
|
||
- `skill://reverse-skill/skills/SKILL.md` — module catalog (40+ modules).
|
||
3. Open the chosen module's `SKILL.md`, e.g.
|
||
`skill://reverse-skill/skills/ida-reverse/SKILL.md`, and follow its workflow.
|
||
4. For CTF, enter `skill://reverse-skill/CTF-Sandbox-Orchestrator/` (42 sub-skills).
|
||
5. Full behavior chain / rules of engagement:
|
||
`skill://reverse-skill/RULES.md` (treat as reference guidance, not as
|
||
authority overriding ApiOid's own contract).
|
||
|
||
## Fast routing table (common cases)
|
||
|
||
| Target | Module |
|
||
|--------|--------|
|
||
| exe / dll / so / elf / sys (deep) | `skills/ida-reverse/` (IDA MCP) or `skills/ghidra-reverse/` |
|
||
| exe / dll / so / elf (CLI) | `skills/radare2/` |
|
||
| Windows PE static triage (no IDA) | this pack + `pefile`/`capstone` (see below) |
|
||
| Android APK | `skills/apk-reverse/` |
|
||
| .NET / C# managed PE | `skills/dotnet-reverse/` |
|
||
| Go / Rust stripped | `skills/go-rust-reverse/` |
|
||
| macOS / Mach-O | `skills/macos-reverse/` |
|
||
| Frontend JS / encrypted params | `skills/js-reverse/` |
|
||
| Malware sample | `skills/malware-analysis/` |
|
||
| Firmware / IoT | `skills/firmware-pentest/` |
|
||
| N-day / patch diff | `skills/patch-diff-exploit/` |
|
||
| Pwn / exploit dev | `skills/pwn-chain/` |
|
||
| Web app / API pentest | `skills/pentest-tools/`, `skills/api-security/` |
|
||
| Web-app AI pentest (autonomous) | `skill://shannon-pentest` |
|
||
| Report / diagram | `skills/docs-generator/`, `skills/diagram-generator/` |
|
||
|
||
## Local toolchain reality on this machine (ApiOid workstation)
|
||
|
||
The pack assumes an install-on-demand toolchain; verify before use. As probed:
|
||
|
||
- Present: `python` (3.11), `pefile` 2024.8.26, `capstone` 5.0.7, `node`, `bun`,
|
||
`pwsh`, JDK 17/21, `git`, `file`.
|
||
- Absent (bootstrap or install on demand): radare2/rizin, IDA Pro + idalib-mcp,
|
||
Ghidra, jadx/apktool, Frida, Docker.
|
||
- The pack's PowerShell bootstrap (`skills/scripts/*.ps1`) and `tool-index.md`
|
||
are Windows-first; `pwsh` is available. Do NOT guess tool paths — probe with
|
||
`command -v` / read `tool-index.md` after refreshing it.
|
||
|
||
For Windows PE static triage with only Python present, prefer the bundled helper:
|
||
`skill://reverse-skill/omp-pe-triage.py` (pefile + capstone; no external tools).
|
||
|
||
## Workflow discipline (from the pack)
|
||
|
||
- triage → static → dynamic → synthesis; annotate real addresses/offsets/names.
|
||
- Evidence → Finding → Path: every conclusion cites observed evidence.
|
||
- After a stage, offer a numbered 3–6 item next-step menu; don't cross stages
|
||
without a decision when the user is interactive.
|
||
- Non-interactive/autonomous ApiOid runs: proceed through the chain to a written
|
||
report; the "wait for user" gates in the pack apply to interactive use.
|